Identifying relationships between intelligence dashboards

Abstract

First and second dashboards that provide a visual representation of respective intelligence information for a firewall may be generated. An indicator of correspondence between a first data element of the respective intelligence information for the first dashboard and a second data element of the respective intelligence information for the second dashboard may be displayed as an overlay of the first and second dashboards. Additionally, a guidance indicator that indicates an order to access respective values of the first dashboard, the second dashboard, and a third dashboard may be displayed based on an identifier of the first data element mapped to an identifier of the second data element and an identifier of the second data element mapped to an identifier of a third data element for the third dashboard. A summary window that provides a summary of intelligence dashboards of a user interface may be displayed.

What is claimed is: 
     
         1 . A method, comprising:
 generating, by one or more computing devices, a first and a second dashboard that each provide a visual representation of respective intelligence information for a firewall identified from raw operational data associated with the firewall;   mapping, by the one or more computing devices, an identifier of a first data element of the respective intelligence information for the first dashboard to an identifier of a second data element of the respective intelligence information for the second dashboard based on a correspondence between the first data element and the second data element;   receiving a selection of the first data element and a selection of a menu item; and   displaying, by the one or more computing devices, an indicator element that indicates correspondence between the first data element and the second data element based on the mapping and the selected menu item,   wherein the indicator element is displayed as an overlay of at least a portion of the first dashboard and at least a portion of the second dashboard.   
     
     
         2 . The method of  claim 1 , wherein the mapping the identifier of the first data element to the identifier of the second data element is responsive to a notification of an event for a resource protected by the firewall and associated with the first dashboard. 
     
     
         3 . The method of  claim 1 , wherein the correspondence between the first data element and the second data element is based on at least one of: a value for the first data element and a value for the second data element, a correspondence between a type of security event for a resource associated with the firewall and a source of the security event, or a correspondence between a type of the resource and a type of event for the resource. 
     
     
         4 . The method of  claim 1 , further comprising displaying, based on the identifier of the second data element mapped to an identifier of a third data element of the respective intelligence information for a third dashboard, a guidance indicator that indicates an order to access respective values of the first dashboard, the second dashboard, and the third dashboard. 
     
     
         5 . The method of  claim 1 , further comprising adjusting, based on a change in position for at least one of the first dashboard or the second dashboard, a position of at least a portion of the indicator element to correspond to the changed position of at least one of the first dashboard or the second dashboard. 
     
     
         6 . The method of  claim 1 , wherein the generating the first dashboard and the second dashboard further comprises:
 receiving, based on the raw operational data input into a predictive model trained to identify types of dashboards from raw data, an indication of one or more types of dashboards for the raw operational data; and   generating, based at least in part on one or more portions of the raw operational data transformed to respective formats for the one or more types of dashboards indicated by the predictive model, the first dashboard and the second dashboard.   
     
     
         7 . The method of  claim 1 , wherein the firewall comprises at least one of a web application firewall, a proxy firewall, or a virtual private network (VPN) firewall. 
     
     
         8 . A system comprising:
 a memory; and   at least one processor coupled to the memory and configured to perform operations comprising:   generating a first and a second dashboard that each provide a visual representation of respective intelligence information for a firewall identified from raw operational data associated with the firewall;   mapping an identifier of a first data element of the respective intelligence information for the first dashboard to an identifier of a second data element of the respective intelligence information for the second dashboard based on a correspondence between the first data element and the second data element;   receiving a selection of the first data element and a selection of a menu item; and   displaying an indicator element that indicates correspondence between the first data element and the second data element based on the mapping and the selected menu item,   wherein the indicator element is displayed as an overlay of at least a portion of the first dashboard and at least a portion of the second dashboard.   
     
     
         9 . The system of  claim 8 , wherein the mapping the identifier of the first data element to the identifier of the second data element is responsive to a notification of an event for a resource protected by the firewall and associated with the first dashboard. 
     
     
         10 . The system of  claim 8 , wherein the correspondence between the first data element and the second data element is based on at least one of: a value for the first data element and a value for the second data element, a correspondence between a type of security event for a resource associated with the firewall and a source of the security event, or a correspondence between a type of the resource and a type of event for the resource. 
     
     
         11 . The system of  claim 8 , the operations further comprising displaying, based on the identifier of the second data element mapped to an identifier of a third data element of the respective intelligence information for a third dashboard, a guidance indicator that indicates an order to access respective values of the first dashboard, the second dashboard, and the third dashboard. 
     
     
         12 . The system of  claim 8 , the operations further comprising adjusting, based on a change in position for at least one of the first dashboard or the second dashboard, a position of at least a portion of the indicator element to correspond to the changed position of at least one of the first dashboard or the second dashboard. 
     
     
         13 . The system of  claim 8 , wherein the generating the first dashboard and the second dashboard further comprises:
 receiving, based on the raw operational data input into a predictive model trained to identify types of dashboards from raw data, an indication of one or more types of dashboards for the raw operational data; and   generating, based at least in part on one or more portions of the raw operational data transformed to respective formats for the one or more types of dashboards indicated by the predictive model, the first dashboard and the second dashboard.   
     
     
         14 . The system of  claim 8 , wherein the firewall comprises at least one of a web application firewall, a proxy firewall, or a virtual private network (VPN) firewall. 
     
     
         15 . A non-transitory computer-readable medium having instructions stored thereon that, when executed by at least one computing device, cause the at least one computing device to perform operations comprising:
 generating a first and a second dashboard that each provide a visual representation of respective intelligence information for a firewall identified from raw operational data associated with the firewall;   mapping an identifier of a first data element of the respective intelligence information for the first dashboard to an identifier of a second data element of the respective intelligence information for the second dashboard based on a correspondence between the first data element and the second data element;   receiving a selection of the first data element and a selection of a menu item; and   displaying an indicator element that indicates correspondence between the first data element and the second data element based on the mapping and the selected menu item,   wherein the indicator element is displayed as an overlay of at least a portion of the first dashboard and at least a portion of the second dashboard.   
     
     
         16 . The non-transitory computer-readable medium of  claim 15 , wherein the mapping the identifier of the first data element to the identifier of the second data element is responsive to a notification of an event for a resource protected by the firewall and associated with the first dashboard. 
     
     
         17 . The non-transitory computer-readable medium of  claim 15 , wherein the correspondence between the first data element and the second data element is based on at least one of: a value for the first data element and a value for the second data element, a correspondence between a type of security event for a resource associated with the firewall and a source of the security event, or a correspondence between a type of the resource and a type of event for the resource. 
     
     
         18 . The non-transitory computer-readable medium of  claim 15 , the operations further comprising displaying, based on the identifier of the second data element mapped to an identifier of a third data element of the respective intelligence information for a third dashboard, a guidance indicator that indicates an order to access respective values of the first dashboard, the second dashboard, and the third dashboard. 
     
     
         19 . The non-transitory computer-readable medium of  claim 15 , the operations further comprising adjusting, based on a change in position for at least one of the first dashboard or the second dashboard, a position of at least a portion of the indicator element to correspond to the changed position of at least one of the first dashboard or the second dashboard. 
     
     
         20 . The non-transitory computer-readable medium of  claim 15 , wherein the generating the first dashboard and the second dashboard further comprises:
 receiving, based on the raw operational data input into a predictive model trained to identify types of dashboards from raw data, an indication of one or more types of dashboards for the raw operational data; and   generating, based at least in part on one or more portions of the raw operational data transformed to respective formats for the one or more types of dashboards indicated by the predictive model, the first dashboard and the second dashboard.